CVE-2026-20110

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-20110
A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability exists because incorrect privileges are associated with the start maintenance command. An attacker could exploit this vulnerability by accessing the management CLI of the affected device as a low-privileged user and using the start maintenance command. A successful exploit could allow the attacker to put the device in maintenance mode, which shuts down interfaces, resulting in a denial of service (DoS) condition. In case of exploitation, a device administrator can connect to the CLI and use the stop maintenance command to restore operations.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.0 / Impact : 4.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-mntc-dos-LZweQcyq
Configurations

No configuration.

History

17 Jun 2026, 10:17

Type Values Removed Values Added
Summary
  • (es) Una vulnerabilidad en la CLI de Cisco IOS XE Software podría permitir a un atacante autenticado y local causar una condición de denegación de servicio (DoS) en un dispositivo afectado. Esta vulnerabilidad existe porque se asocian privilegios incorrectos con el comando start maintenance. Un atacante podría explotar esta vulnerabilidad al acceder a la CLI de gestión del dispositivo afectado como un usuario con pocos privilegios y usar el comando start maintenance. Un exploit exitoso podría permitir al atacante poner el dispositivo en modo de mantenimiento, lo que apaga las interfaces, resultando en una condición de denegación de servicio (DoS). En caso de explotación, un administrador del dispositivo puede conectarse a la CLI y usar el comando stop maintenance para restaurar las operaciones.

25 Mar 2026, 16:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-25 16:16

Updated : 2026-06-17 10:17

NVD link : CVE-2026-20110

Mitre link : CVE-2026-20110

CVE.ORG link : CVE-2026-20110

JSON object : View

Products Affected

No product.

CWE
CWE-266

Incorrect Privilege Assignment